Тема: Энциклопедия уязвимых скриптов
Показать сообщение отдельно

  #463  
Старый 03.08.2011, 01:15
Unknown
Новичок
Регистрация: 21.06.2005
Сообщений: 0
С нами: 10992741

Репутация: 0
По умолчанию
ljfCMS blind sql-inj [POST method]

made in china

login.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][/COLOR][COLOR="#DD0000"]"login_sucess"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"Action"[/COLOR][COLOR="#007700"]=>[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"]{[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]AName[/COLOR][COLOR="#007700"]]}[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"]));

[/COLOR][COLOR="#0000BB"]alert[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"login sucess"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"location"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"index.php"[/COLOR][COLOR="#007700"]);

 }

 else

{

 new[/COLOR][COLOR="#0000BB"]ActionLog[/COLOR][COLOR="#007700"](array([/COLOR][COLOR="#DD0000"]"LogType"[/COLOR][COLOR="#007700"]=>[/COLOR][COLOR="#DD0000"]"login_err"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"Action"[/COLOR][COLOR="#007700"]=>[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"]{[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]AName[/COLOR][COLOR="#007700"]]}[/COLOR][COLOR="#DD0000"],[/COLOR][COLOR="#007700"]{[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]APwd[/COLOR][COLOR="#007700"]]}[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"]));

[/COLOR][COLOR="#0000BB"]alert[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"�û���������"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"location"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"login.php"[/COLOR][COLOR="#007700"]);

 }

}

if([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'action'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#DD0000"]'logout'[/COLOR][COLOR="#007700"])

{

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'AID'[/COLOR][COLOR="#007700"]] =[/COLOR][COLOR="#DD0000"]''[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]session_destroy[/COLOR][COLOR="#007700"]();

}

[/COLOR][COLOR="#0000BB"]?>

[/COLOR]if(location.href != top.location.href)top.location.href=location.href;

�û���

����

[COLOR="#0000BB"][/COLOR][/COLOR] 
Admin.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][/COLOR][COLOR="#0000BB"]AID[/COLOR][COLOR="#007700"]))

 {

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"select * from Admin where PID=[/COLOR][COLOR="#007700"]{[/COLOR][COLOR="#0000BB"]$this[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]AID[/COLOR][COLOR="#007700"]}[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#0000BB"]$conn[/COLOR][COLOR="#007700"]);

 while([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_fetch_array[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]))

 {

[/COLOR][COLOR="#0000BB"]$arr[/COLOR][COLOR="#007700"][] = new[/COLOR][COLOR="#0000BB"]Admin[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]);

 }

 }

 return[/COLOR][COLOR="#0000BB"]$arr[/COLOR][COLOR="#007700"];

 }

 function[/COLOR][COLOR="#0000BB"]parent[/COLOR][COLOR="#007700"]()

 {

 global[/COLOR][COLOR="#0000BB"]$conn[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$admin[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]NULL[/COLOR][COLOR="#007700"];

 if([/COLOR][COLOR="#0000BB"]$this[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]PID[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"])

 return[/COLOR][COLOR="#0000BB"]$admin[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"select * from Admin where AID=[/COLOR][COLOR="#007700"]{[/COLOR][COLOR="#0000BB"]$this[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]PID[/COLOR][COLOR="#007700"]}[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]);

 if([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_fetch_array[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]))

 {

[/COLOR][COLOR="#0000BB"]$admin[/COLOR][COLOR="#007700"]= new[/COLOR][COLOR="#0000BB"]admin[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]);

 }

 return[/COLOR][COLOR="#0000BB"]$admin[/COLOR][COLOR="#007700"];

 }

 function[/COLOR][COLOR="#0000BB"]CPower[/COLOR][COLOR="#007700"]()

 {

 return[/COLOR][COLOR="#0000BB"]unserialize[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$this[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]CPower[/COLOR][COLOR="#007700"]);

 }

 function[/COLOR][COLOR="#0000BB"]login[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$postdata[/COLOR][COLOR="#007700"])

 {

[/COLOR][COLOR="#0000BB"]extract[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$postdata[/COLOR][COLOR="#007700"]);

 global[/COLOR][COLOR="#0000BB"]$conn[/COLOR][COLOR="#007700"];

 if([/COLOR][COLOR="#0000BB"]$AName[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#DD0000"]''[/COLOR][COLOR="#007700"]||[/COLOR][COLOR="#0000BB"]$APwd[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#DD0000"]''[/COLOR][COLOR="#007700"])

[/COLOR][COLOR="#0000BB"]alert[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"�û������벻Ϊ��"[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"select * from Admin where AName='[/COLOR][COLOR="#0000BB"]$AName[/COLOR][COLOR="#DD0000"]'"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]);

 if([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_fetch_array[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]))

 {

 if([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'APwd'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#0000BB"]md5[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$APwd[/COLOR][COLOR="#007700"]))

 {

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'AID'[/COLOR][COLOR="#007700"]] =[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'AID'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'AName'[/COLOR][COLOR="#007700"]] =[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'AName'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Power'[/COLOR][COLOR="#007700"]] =[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Power'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'CPower'[/COLOR][COLOR="#007700"]] =[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'CPower'[/COLOR][COLOR="#007700"]];

 return[/COLOR][COLOR="#0000BB"]true[/COLOR][COLOR="#007700"];

 }

 }

 return[/COLOR][COLOR="#0000BB"]false[/COLOR][COLOR="#007700"];

 }

 function[/COLOR][COLOR="#0000BB"]delete[/COLOR][COLOR="#007700"]()

 {

 global[/COLOR][COLOR="#0000BB"]$conn[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"delete * from Admin where AID=[/COLOR][COLOR="#007700"]{[/COLOR][COLOR="#0000BB"]$this[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]AID[/COLOR][COLOR="#007700"]}[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$children[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$this[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]children[/COLOR][COLOR="#007700"]();

 if([/COLOR][COLOR="#0000BB"]$children[/COLOR][COLOR="#007700"])

 {

 foreach([/COLOR][COLOR="#0000BB"]$children[/COLOR][COLOR="#007700"]as[/COLOR][COLOR="#0000BB"]$child[/COLOR][COLOR="#007700"])

[/COLOR][COLOR="#0000BB"]$child[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]delete[/COLOR][COLOR="#007700"]();

 }

 return[/COLOR][COLOR="#0000BB"]true[/COLOR][COLOR="#007700"];

 }

}

[/COLOR][COLOR="#FF8000"]/*

CREATE TABLE `Admin` (

`AID` int(10) unsigned NOT NULL auto_increment,

`AName` varchar(255) NOT NULL,

`APwd` varchar(255) NOT NULL,

`PID` int(10) unsigned NOT NULL,

`AddDate` int(11) NOT NULL default '0',

`Power` int(11) NOT NULL default '0',

`CPower` text NOT NULL,

PRIMARY KEY (`AID`),

UNIQUE KEY `AName` (`AName`)

) ENGINE=MyISAM DEFAULT CHARSET=latin1

*/

[/COLOR][COLOR="#0000BB"]?>[/COLOR][/COLOR] 


Ну и собственно сплоит "на скорую руку":

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][/COLOR][/COLOR] 
 
Ответить с цитированием